WordPress.org
Get WordPress

Plugin Directory

Changeset 3386339


Ignore:
Timestamp:
10/29/2025 10:39:21 AM (5 months ago)
Author:
Jonua
Message:
  • Adds sanitizing table data using wp_kses( $data, 'post' ) during update_field().
  • Fixes a Cross-Site Scripting vulnerability in table cell content exploitable by authenticated users with Author-level access or higher.
  • Fixes minor table cell editor style issues.
Location:
advanced-custom-fields-table-field/trunk
Files:
1 added
2 deleted
5 edited

Legend:

Unmodified
Added
Removed

  • advanced-custom-fields-table-field/trunk/acf-table.php

    r3337292 r3386339  
    44Plugin URI: https://www.acf-table-field.com
    55Description: This free Add-on adds a table field type for the plugins Advanced Custom Fields and Secure Custom Fields.
    6 Version: 1.3.30
     6Version: 1.3.31
    77Author: Johann Heyne
    88Author URI: http://www.johannheyne.de

  • advanced-custom-fields-table-field/trunk/changelog.txt

    r3337292 r3386339  
    11== Changelog ==
     2
     3= 1.3.31 =
     4* Adds sanitizing table data using wp_kses( $data, 'post' ) during update_field().
     5* Fixes a Cross-Site Scripting vulnerability in table cell content exploitable by authenticated users with Author-level access or higher.
     6* Fixes minor table cell editor style issues.
    27
    38= 1.3.30 =

  • advanced-custom-fields-table-field/trunk/class-jh-acf-field-table.php

    r3337292 r3386339  
    4040        */
    4141        $this->settings = array(
    42             'version' => '1.3.30',
     42            'version' => '1.3.31',
    4343            'dir_url' => plugins_url( '', __FILE__ ) . '/',
    4444        );
    … …  
    288288
    289289        // register & include JS
    290         wp_enqueue_script( 'acf-input-table', $this->settings['dir_url'] . 'js/input-v5.js', array( 'jquery', 'acf-input' ), $this->settings['version'], true );
     290        wp_enqueue_script( 'acf-input-table', $this->settings['dir_url'] . 'js/input.js', array( 'jquery', 'acf-input' ), $this->settings['version'], true );
    291291
    292292        // register & include CSS
    … …  
    558558        // }
    559559
     560        // SANITIZES DATA VALUES {
     561
     562            // CAPTION
     563            if ( isset( $value['p']['ca'] ) ) {
     564
     565                $value['p']['ca'] = wp_kses( $value['p']['ca'], 'post' );
     566            }
     567
     568            // HEADER CELL VALUES
     569            if (
     570                isset( $value['h'] ) &&
     571                is_array( $value['h'] )
     572            ) {
     573
     574                array_walk_recursive( $value['h'], function ( &$item ) {
     575
     576                    if ( is_string( $item ) ) {
     577
     578                        $item = wp_kses( $item, 'post' );
     579                    }
     580                });
     581
     582            }
     583
     584            // BODY CELL VALUES
     585            if (
     586                isset( $value['b'] ) &&
     587                is_array( $value['b'] )
     588            ) {
     589
     590                array_walk_recursive( $value['b'], function ( &$item ) {
     591
     592                    if ( is_string( $item ) ) {
     593
     594                        $item = wp_kses( $item, 'post' );
     595                    }
     596                });
     597
     598            }
     599
     600        // }
     601
    560602        // $post_id is integer when post is saved, $post_id is string when block is saved
    561603        if ( gettype( $post_id ) === 'integer' ) {

  • advanced-custom-fields-table-field/trunk/css/input.css

    r2557538 r3386339  
    266266        position: absolute;
    267267        left: 3px;
    268         bottom: -17px;
     268        bottom: -15px;
    269269        width: 0;
    270270        height: 0;
    … …  
    277277        position: absolute;
    278278        left: 4px;
    279         bottom: -12px;
     279        bottom: -10px;
    280280        width: 0;
    281281        height: 0;
    … …  
    285285    .acf-table-cell-editor-textarea {
    286286        border: none !important;
     287        border-radius: 0 !important;
    287288        padding: 3px 7px !important;
    288289        background-color: #e5f8ff;
    … …  
    291292        min-width: 180px;
    292293        min-height: 61px !important;
    293 
     294        box-shadow: none !important;
    294295        /* fix profile.php ACF v4 */
    295296        width: auto !important;

  • advanced-custom-fields-table-field/trunk/readme.txt

    r3337606 r3386339  
    519519== Changelog ==
    520520
     521= 1.3.31 =
     522* Adds sanitizing table data using wp_kses( $data, 'post' ) during update_field().
     523* Fixes a Cross-Site Scripting vulnerability in table cell content exploitable by authenticated users with Author-level access or higher.
     524* Fixes minor table cell editor style issues.
     525
    521526= 1.3.30 =
    522527* Enables using update_field() on user fields
Note: See TracChangeset for help on using the changeset viewer.